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This module should be read in conjunction with the Introduction and with the 
Glossary, which contains an explanation of abbreviations and other terms used in 
this Manual. If reading on-line, click on blue underlined headings to activate 
hyperlinks to the relevant module. 


Purpose 


To specify the minimum standards that Als should observe in relation to 
the sharing and use of consumer credit data through a-credit reference 
agenciesy. 


Classification 


A statutory guideline issued by the MA under the Banking Ordinance, 
§16(10) 


Previous guidelines superseded 


IC-6 “The Sharing and Use of Consumer Credit Data through a Credit 
Reference Agency” (V.45 dated 14.02.09.44}14). 


Application 


To Als which are involved in the provision of consumer credit. 


Structure 
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Schedule 1 Prescribed documents 


Introduction 


1l Credit reference agencies (“CRAs”) are organisations that engage 
in the collection, maintenance and dissemination of information 


about borrowers’ creditworthiness to lending institutions. 


1.2 _ In Hong Kong, credit providers have been sharing consumer credit 
data since early 1980s. A fully-fledged CRA was established in late 
1990s featuring full participation of Als involved in provision of 
consumer credit. Over the years, the data sharing arrangements 
were enhanced and the data scope was expanded from negative 
credit data to cover positive data_relating to credit cards and 
unsecured personal loans in 2003, and further to cover positive 
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mortgage data in 2011. 
To In 2018, the Hong Kong Monetary Authority (“HKMA”) started 


discussion with the banking industry ways to further enhance the 
mechanism of sharing and use of consumer credit data through a 
CRA. _It highlighted the need of introducing more than one fully- 
fledged CRAs with a view to enhancing the service quality of CRAs, 
improving protection to consumers, and reducing the operational 
risk of having only one service provider in the market, particularly 


the risk of single point of failure. With the support of the HKMA, the 
Hong Kong Association of Banks (“HKAB”), the DTC Association 


“DTCA”) and the Hong Kong S.A.R. Licensed Money Lenders 
Association Ltd. (“LMLA”) developed the Multiple Credit Reference 
Agencies Model underpinned by the prescribed documents _in 


Schedule 1 of this module. The Model will be in operation on the 
Effective Date. 























+21.4 The Office of the Privacy Commissioner for Personal Data 
(“PCPD”) issued the Code of Practice on Consumer Credit Data 
“the Code”) under §12 of the Personal Data (Privacy) Ordinance 
“PDPO”) to provide the Goede provides practical guidance to credit 
providers, including Als and their subsidiaries within the meaning of 
§2 of the Banking Ordinance, and credit reference agencies 
EGCGRAs>}on the handling of consumer credit data. Ihe Code 
deals with issues relating to the collection, accuracy, use, security, 
access and correction of consumer credit data. A breach of the 
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2. 


requirements under the Code would be accepted as evidence of 
breach of the relevant data protection principles or provisions under 
the Persenat Data(Prvacy} Ordinance “PDPO” unless there is 
evidence that the requirement of the OrdinancePDPO was actually 
complied with in a different way, notwithstanding the non- 
observance of the Code. +hePCThe Privacy Commissioner for 
Personal Data (“PC”) may issue an enforcement notice to a data 
user following investigation of an alleged contravention of the 
relevant data protection principles and provisions of the PDPO. 
Contravention of the enforcement notice by a data user after the 
enforcement notice is served on him would constitute an offence. 
In case of any conflict between this module and the Code, the Code 
shall prevail. 





+31.5 The minimum authorization criterion under paragraph 10 of the 


Seventh Schedule to the Banking Ordinance provides that the MA 
must be satisfied that an Al has, among others, adequate systems 
of control. The MA considers that this would include adequate 
systems of control to enable the Al to manage its credit risk 
effectively, and to properly protect and use consumer credit data. 
In this regard, the MA will take into account the extent to which Als 
make full use of all relevant information (including that obtained 
from CRAs) in managing their credit exposure and whether Als 
have adequate controls to ensure that their consumer credit data 
are properly safeguarded. 


441.6 Failure to adhere to the standards and requirements set out in this 


module may call into question whether the Al continues to satisfy 
the relevant authorization criterion under the Banking Ordinance. 


Definition 


The terms used in this module have the following meaning: 


° “Consumer credit data” means any personal data 
concerning an individual collected by an Al in the course of 
or in connection with the provision of consumer credit, or 
any personal data collected by or generated in the database 
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of a CRA (including the mortgage count) in the course of or 
in connection with the providing of consumer credit 
reference service. 


“Consumer credit” means any loan, overdraft facility or other 
kind of credit, including leasing and hire-purchase, provided 
by an Al to and for the use of an individual as borrower, or 
to and for the use of another person for whom an individual 
acts as mortgagor or guarantor. 


“Credit reference agency” (“CRA”) means any data user 
who carries on a business of providing a consumer credit 
reference service, whether or not that business is the sole 
or principal activity of that CRA. On and after the Effective 
Date, CRA means any selected CRAs in the Multiple Credit 
Reference Agencies Model. 


“Interbank Debt Relief Plan” means an agreement to be 
concluded between a Debtor and attmultiple Creditors, 
having an exposure to the Debtor, for partial relief and/or 
rescheduling of debts owed to those Creditors pursuant to 
the terms of the Agreement for Interbank Debt Relief Plans 
endorsed by the Hong Kong Association of Banks, the DTC 
Association; jati 

Limited and the Hong Kong S.A.R. Licensed Money 
Lenders Association. 


“Effective dateDate” means +Apri 20+ |: 


“Loan restructuring arrangement” means any scheme of 
arrangement in relation to debts owed by an individual 
consequent upon a default in the repayment of those debts. 


“Material default” means a default in payment for a period in 
excess of 60 days. 


“Mortgage account general data” has the same meaning as 
in clause—244A—of}—the Code of Practice on Consumer 
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Credit__Data issued by the Office of the Privacy 
Commissioner for Personal Data. 


e “Mortgage loan” means a loan secured or to be secured by 
residential, retail, commercial or industrial properties, unless 
otherwise specified, and reference to “mortgage” shall be 
construed accordingly. 


° “Mortgage Count” means the number of mortgage loans 
under which an individual is a borrower, mortgagor and/or 
guarantor. 

e “Multiple Credit Reference Agencies Model” means _the 


multiple CRAs model developed by the Hong Kong 
Association of Banks, the DTC Association and the Hong 
Kong S.A.R. Licensed Money Lenders Association which 
enables credit providers to share and use consumer credit 
data_through more than one CRAs for the provision of 
consumer credit reference services, underpinned by the 
prescribed documents in Schedule 1 of this module. 

e “Multiple Credit Reference Agencies Platform” means the 
computer system and network operated by an independent 
operator _as_ a data switch between participating credit 
providers and the CRA(s) under the Multiple Credit 
Reference Agency Model for the transmission of consumer 
credit data, credit reports and other relevant information in 
encrypted form. 


° “Prescribed consent” means the express consent of an 
individual given voluntarily but does not include any consent 
which has been withdrawn by notice in writing served on the 
person to whom the consent has been given (but without 
prejudice to so much of that act that has been done 
pursuant to the consent at any time before the notice is so 
served). 
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s For the purpose of paragraphs 5.3.1, 6.1, 6.5-aad 4+ and 
other related paragraphs, “review” means consideration by 
the Al of any of the following matters (and those matters 
only) in relation to existing credit facilities provided to the 
individual, namely: (i) an increase in the credit amount; (ii) 
the curtailing of credit (including the cancellation of credit or 
a decrease in the credit amount); or (iii) the putting in place 
or the implementation of a scheme of arrangement with the 
individual. 


° “Scheme of arrangement” means any restructuring, 
rescheduling or other modification of terms of whatsoever 
nature in relation to debts owed by an individual, whether as 
borrower, as mortgagor or as guarantor, towards a single 
creditor or more than one creditors. 


o—__—_Transitional period” _means—the—period of 24 months 
beginning—on_the—effective_date—and_ending—on the day- 
pelote le cesses GH vecarnrolihe-ctecive cote. 








3. Comprehensive participation 


34— The HKMA believes that athe operation of fully-fledged consumer 
credit database(s), including both positive and negative data, will be 
beneficial to Als (in enabling them to be better informed and make 
more accurate assessment of customers’ creditworthiness) and 
consumers (in enforcing borrower discipline, reducing cross 
subsidisation among consumers with different credit profiles and 
ee access to bank oe aE Rica 














built up. which would help Als better manage their consumer credit 
expesurelo realise such benefits, the HKMA expects all Als that 
are involved in the provision of consumer credit to participate as 
fully as possible in the sharing and use of consumer credit data 


(including positive mortgage data) through a-CRA(s) within the 
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framework laid down by the Code. FellewiagWith the amendments 
te-operation of the Code-on+t Apri! 2044 Multiple Credit Reference 
Agencies Model after the Effective Date, it is important that the 


database of each CRA must be adequately comprehensive. The 
HKMA therefore expects althe Als to share consumer credit data to 


each and use positive mortgage data through the CRA withinevery 


CRA in the Multiple Credit Reference Agencies Model in line with 
the framework laid down in-the-revised Code—Ataminimum Als 








the Association—of—Banks—and—_the—DTFG 
Asseciation-prescribed documents in Schedule 1 of this module. 


3.33.2 The HKMA also considers that using consumer credit data from 2 
CRA(s) for assessing credit applications (including mortgage loan 
applications) and conducting credit reviews is an essential part of 
an Al’s credit management system unless there are satisfactory 
alternative arrangements for the comprehensive sharing of 
consumer credit data. 


3.43.3 The HKMA would take into account the extent to which an Al 
participates in the contribution of consumer credit data to and 
makes full use of the same from a—CRA(s) in assessing the 
effectiveness of the Al’s credit management system. 


3.53.4 Where an Al does not, in the opinion of the HKMA, make 
appropriate use of the relevant facilities of a-CRA;(s), one option 
would be for the HKMA to require the Al concerned to mitigate the 
risk by restricting the amount of consumer credit business that it 
undertakes. 


3.5 Without the need for each individual credit provider to establish 
direct bilateral network connection with each individual CRA under 
the Multiple Credit Reference Agencies Model, a Multiple Credit 
Reference Agencies Platform will be introduced and operated by an 
independent operator as a data switch between participating credit 
providers and the CRA(s) for the transmission of consumer credit 
data, credit reports and other relevant information in encrypted 
form. The Multiple Credit Reference Agencies Platform will enable 


high scalability for credit providers and CRAs to link up; make 
available a full set of consumer credit data to all CRAs with a 
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3.6 


master copy as backup, and enhance data protection through 
proper security and access control arrangements. The HKMA 
considers that Als participating in the Multiple Credit Reference 
Agencies Model should do so via the Multiple Credit Reference 
Agencies Platform. 


The senior management of Als should ensure that sufficient priority 
and resources are devoted to enabling the computer systems of 
their institution to interface with those of the-CRA(s) in a timely and 
effective manner, in terms of contributing and making enquiry of 
consumer credit data. They should ensure the same when the 
Multiple Credit Reference Agencies Model is in operation after the 
Effective Date, under which the interfacing with CRAs will be via the 
Multiple Credit Reference Agencies Platform. 


Handling of positive mortgage data 


Li Gener 
4.24.1 For the purpose of setting up a comprehensive mortgage loan 


database by #he—CRA(s) and to comply with the PDPO’s 
requirement, Als are required to seek the prescribed consent of 
their existing mortgage customers and mortgage loan applicants 
(i.e. borrowers, mortgagors or guarantors) before uploading their 
pre-existing mortgage data to t#e-CRA(s). Pre-existing mortgage 
data refers to the mortgage account general data of any account 
relating to a mortgage loan which already existed prior to the 
effective date April 2011 and continues to exist after that date. 


4.34.2 Where prescribed consent is obtained, an Al should adopt prudent 


procedures to check its validity through verifying the signature of a 

customer on the consent seeking form or other appropriate means. 

4.11+To-ensure atevel playing field and the comprehensiveness 
eya ane te P i vie asiri A pili p ieee 
relevant—customers—-and-do-not-do-so—only—on—a—selective 
basis- 
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sybjectSubject to Als’ compliance of the relevant_notification 
requirement under clause-24B8-of the Code, Als have theghtare 
permitted to upload to the-CRA(s) the mortgage account general 
data of new mortgage loans whose applications are received on or 


after the-effective-date.1 April 2011. To enable the uploading of 
such mortgage data, Als should ensure that before collecting 
customers’ personal data for mortgage loan applications, the 
relevant Personal Information Collection Statement is provided to 
customers in order to comply with the notification requirements 


under the Code-sers-a-ciohc-proviciosn- oLconsumersresiteais 
relating to mortgage loans. 


474.4 te-ocder io aoketLuse-stise Ms sshomo—serl or all relevant 
mortgage loan applications received on or after the—effective 
datel April 2011, the HKMA expects that Als would, as part of the 
mortgage loan application process, seek to obtain from mortgage 
loan applicants prescribed consent for the uploading of their pre- 
existing positive mortgage data to ‘he-CRA(s) in case they have not 
already given such consent previously. 





4.84.5 Als should explain to the mortgage applicant that the prescribed 
consent applies to the pre-existing positive mortgage data and such 
consent will be addressed to all credit providers who are members 
of the/ have subscription agreements with CRA(s) (“Members”) and 
to each of the CRA(s). After the prescribed consent is received, it 
will be passed to the CRA which will then check with all its 
Members to verify if the customer has any mortgage loan with any 
of them. The CRA will upload any mortgage account general data 
of the customer it receives to its database, compile the mortgage 
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count of that customer, and then report the mortgage count back to 
the mortgage loan processing Al. 


4.94.6 Where prescribed consent for the sharing of pre-existing positive 
mortgage data and written consent for accessing the mortgage 
count held by ##e-CRA(s) are obtained from a mortgage loan 
applicant, the mortgage loan processing Al should make use of the 
mortgage count information obtained from the-CRA(s) in verifying 
the applicants declaration in respect of his existing mortgage 
loan(s). 


4404.7 Als should check the mortgage count declared by the 
mortgage loan applicant against the mortgage count obtained from 
the-CRA(s). Follow-up enquiries should be conducted by the Al 
during the loan approval process in case of any discrepancy 
especially where the declared mortgage count is smaller than the 
mortgage count obtained from :he-CRA(s). There should be clear 
and detailed policies and procedures established by Als on the 
mortgage count verification process and the course of actions that 
Als should take where the discrepancy cannot be reconciled. 


4444.8 Where prescribed consent is not obtained, the Al may still 
continue to process the mortgage loan application by obtaining 
additional relevant information from the applicant to assess the 
applicant’s repayment ability. The Al will then decide whether it has 
sufficient information to conduct a credit assessment of the 
customer and whether additional measures are required to mitigate 
the potential credit risk involved. In this regard, Als should comply 
with the requirements stipulated in the relevant guidelines or 
circulars pertaining to PMDSpositive mortgage data sharing and 
mortgage loan business as issued by the HKMA from time to time. 


4424.9 An individual may withdraw his prescribed consent in relation 
to the sharing of pre-existing positive mortgage data by giving a 
notice in writing. Once received, the Al should inform ##e-CRA(s) 
as soon as practicable for follow-up. Als should establish 
appropriate policies and procedures on the handling of customers’ 
withdrawal notices and make reference to the relevant 
requirements of the PDPO where appropriate. 
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5. Safeguards on information security 


5.1 General 


5.1.1 


For any credit information sharing arrangement to be 
effective and credible, the data must be properly 
safeguarded. Otherwise, Als would be subject to 
substantial legal and reputation risks. Als should therefore 
adopt all reasonable procedures to ensure that consumer 
credit data disclosed to or obtained from a—CRA(s) are 
properly safeguarded, with regard to the confidentiality, 
accuracy, relevance and proper utilisation of the 
information. 


5.2 Policies and procedures 


5.2.1 


5.2.2 


5.2.3 


Als should have clear and comprehensive policies and 
procedures for the sharing and use of consumer credit data 
through a—CRA(s) to ensure compliance with the 
requirements of the Code. The policies and procedures 
should be designed to: 


e ensure the security, confidentiality and integrity of 
consumer credit data; and 


s guard against unauthorized access to or use of such 
information that could result in a breach of the Code 
and the data protection principles and relevant 
provisions under the PDPO. 


These policies and procedures should be approved by the 
Board or a designated authority and be properly 
documented. They should be reviewed and updated 
regularly to ensure that they remain appropriate in the light 
of changes in relevant legislation and regulations. Any 
material amendments to the policies and procedures should 
be submitted to the Board or a designated authority for 
formal ratification and adoption. 


The policies and procedures should specify how consumer 
credit data should be handled in cases where the credit 
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5.3 


5.2.4 


application is submitted by an intermediary, who is 
commissioned by the credit applicant to handle his 
application, rather than by the credit applicant himself. In 
processing such a credit application, the Al concerned 
should ensure that the intermediary has obtained the 
authorization of the credit applicant to apply for credit on his 
behalf and to authorize the Al concerned to access the 
applicant’s consumer credit data held by a-CRA(s). Where 
the intermediary does not have such authorization, the Al 
should contact the credit applicant directly to confirm his 
intention to apply for credit from the Al and advise the credit 
applicant that it may access his consumer credit data held 
by a-CRA(s) for the purpose of assessing his application. In 
these latter cases, the Al should also address all future 
correspondence, including any statements or notifications 
required under the Code, to the credit applicant rather than 


the intermediary. In all cases, Als should comply with the 
requirements stipulated in the relevant guidelines or 
circulars pertaining to the engagement of intermediaries as 
issued by the HKMA from time to time. 


Als should ensure adequate management oversight, at an 
appropriate senior level, on the development, 
implementation, and maintenance of these policies and 
procedures. There should also be an effective mechanism 
in place to monitor compliance with them. Any non- 
compliance should be followed up, investigated, rectified 
and reported to management. 


Access control 


5.3.1 


5.3.2 


Als should have written policies specifying who may 
authorize access to the CRA database,consumer credit data 
held by CRA(s), and the criteria that need to be met for 
making such access for review purposes. The policies 
should define clearly the circumstances under which an Al 
may initiate reviews. 


Only designated persons authorized by management should 
be able to access the CRA -database-consumer credit data 
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5.3.3 


5.3.4 


5.3.5 


5.3.6 


5.3.7 


held by CRA(s). There should be clearly defined 
procedures for the authorization of such designated 
persons. Such authorization, and any subsequent changes, 
must be documented. 


Als should maintain stringent control over the use of and 
changes made to the passwords for access to the GRA 
database-consumer credit data held by CRA(s). The 
passwords should only be made available to the designated 
persons who are authorized to access the GRA 
database.consumer credit data held by CRA(s). Als should 
avoid using shared passwords (i.e. two or more persons 
sharing the same password). Under no circumstances 
should passwords be disclosed to unauthorized persons, 
e.g. IT maintenance or service contractors. 


Where access to the consumer credit data held by CRA 
database(s) is made through designated terminals, access 

j it should be 
restricted only to designated persons, such as by way of 
password protection. 


Als should change the passwords for accessing the GRA 


databaseconsumer credit data held by CRA(s) regularly, 


preferably at least quarterly. 


Als should maintain an access log on all instances of 
access to the CRA-database.consumer credit data held by 
CRA(s). The access log should contain sufficient detail as 
evidence of compliance with the Code. It should, as a 
minimum, contain information about the purpose of the 
access, the date on which the access was made and the 
staff who made the access. 


The Al’s internal access log and billing records from the 
CRA(s) should be regularly reviewed, at least on a monthly 
basis, for unusual access activities, such as an unusually 
high volume of access activities that is inconsistent with the 
Al’s business. Such unusual access activities might 
suggest that the designated persons have abused the 
system. Alternatively, any unexplained shortfall in the 
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5.4 


5.3.8 


number of instances of access in the Al’s internal access 
records when compared with the CRA‘s—billing records_of 
CRA(s) might suggest unauthorized access or breaches of 
the Al’s access control. 


Als should undertake prompt investigation of any unusual 
access activities and take prompt remedial actions to follow 
up any irregularities. Such irregularities, and the reasons 
for them, should be brought to management's attention. As 
required by the Code, Als should report any suspected 
breaches of the PDPO or the Code to the PC. 


Confidentiality and retention of CRA credit data 


5.4.1 


5.4.2 


5.4.3 


Als should establish a policy on the safeguarding and 
retention of customer data obtained from #he—CRA(s). 
Specifically, the policy should provide that access to the 
GRA-credit repertreports of CRA(s) should be on a need to 
know basis. There should also be restrictions on how such 
reports may be duplicated, copied or circulated. 


Data Protection Principle 2 of the PDPO requires that 
personal data shall not be kept longer than is necessary for 
the fulfilment of the purpose for which the data are or are to 
be used. Als may need to retain credit reports from a 
CRA(s) as documentary support for the relevant credit 
decisions for which the credit reports were obtained, and as 
file records in the event of subsequent queries or disputes 
raised by customers. With the CRA-database(s) of CRA(s) 
being updated regularly, there would be a breach of the 
Principles if <““out-of-date‘date” information were to be 
retained and used for making subsequent credit decisions. 
Als should ensure that they do not use out--of--date credit 
reports for making credit decisions. 





Where a CRA credit report is obtained for the purpose of 
assessing a credit application and the Al subsequently 
refused the application, or when a customer ceases to have 
any borrowing relationship with the Al, the Al should destroy 
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the relevant credit reports within a reasonable period unless 
such reports are to be used for other permitted purposes. 
5.5 Data accuracy 


5.5.1 


5.5.2 


5.9.3 


5.5.4 


Als should take reasonably practicable steps to check the 
accuracy of their customers’ consumer credit data before 
passing them to *te-CRA(s). Clear procedures should be 
laid down on how changes to customers’ consumer credit 
data are to be implemented, verified and transmitted to the 
CRA(s). 


As for data updating, the Code requires Als to update any 
account data or mortgage account general data previously 
provided to a-CRA(s) promptly or, in any event, by the end 
of each reporting period not exceeding 31 days, until the 
account is terminated or written-off, whereupon the Al shall 
promptly update the account data to indicate such 
termination or write-off. 


In addition, Als should, as soon as reasonably practicable, 
update an individuals consumer credit data upon the 
occurring of repayment in full or in part of any amount in 
default; a scheme of arrangement being entered into with 
the individual; the final settlement of the amount payable 
pursuant to such a scheme of arrangement; or the write off 
of any amount whether or not the amount has been in 
default or the subsequent repayment in full or in part of the 
written off amount. 


Als should follow the requirements set out in clauses 2.7A 
and 2.7B of the Code,—with—effect from—_t_duly 264, in 
reporting account data or mortgage account general data 
held in the database of ‘he-CRA(s). Essentially, in the event 
that an individual makes a request to an Al for updating 
under the circumstances as mentioned in section 5.5.3 
above, the Al should update the account data or mortgage 
account general data of the individual held in the database 
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5.6 


5.7 


5.5.5 


5.5.6 


of the-CRA(s) promptly and in any event not later than 14 
days from the date of receiving the request. 


Where an Al has been provided by a CRA with a credit 
report on an individual and has considered such credit 
report in connection with an application for consumer credit 
by that individual, the Al should, in its notification to the 
individual of its decision on the application, give notice of 
the fact that a credit report has been so considered. The Al 
should also advise the individual on how to contact the CRA 
which provided the credit report, for the purpose of obtaining 
a copy of the credit report for free under clause 3.18 of the 
Code (in which case, the Al has rejected the individual’s 
credit application) and to make a data correction request 
under the PDPO, where appropriate. If a correction request 
made by the individual is subsequently complied with by the 
CRA, the Al concerned should at the request of the 
individual reconsider the credit application on the basis of a 
new credit report obtained from the CRA._!n the event that 


an Al has been provided by more than one CRAs with credit 
reports on the same person and has considered all of such 
credit reports, the Al should apply the above procedures for 
the credit reports from all CRAs involved. 


Where an Al provides consumer credit data which is being 
disputed by the consumer concerned to a-CRA(s), it should 
clearly indicate to the CRA(s) the existence of such a 
dispute and update the data as soon as reasonably 
practicable upon the settlement of the dispute. 


Audit trail 


5.6.1 


The access log records, any investigation reports and follow 
up actions on irregularities or exceptions should be properly 
documented and kept for not less than 2 years. They 
should be maintained in such a manner that would facilitate 
compliance reviews and audits. 


Compliance audit 
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5.8 


5.7.1 Als should conduct a compliance audit at least annually to 
verify whether their data management practices are 
adequate to ensure compliance with the requirements of the 
Code, this module and internal policies and procedures 
regarding the sharing of consumer credit data. 


5.7.2 The audit report should be submitted to the Al’s Board or a 
designated authority for review. This report should assess 
the overall effectiveness of the data management practices 
in ensuring compliance with the Code and this module. The 
reports should cover issues like security breaches or 
violations, management's responses and recommendations 
for improvement. 


Staff training 


5.8.1 Als should provide appropriate guidance and training to staff 
who are involved in the sharing and use of consumer credit 
data through CRA(s). In particular, staff involved in the 
handling of consumer credit data should familiarise 
themselves with the provisions of the Code, this module and 
controls to safeguard the confidentiality of such data. 


Notification of access for review and right to opt-out 


6.1 


6.2 


6.3 


The Code requires credit providers to take practicable and 
reasonable steps to give prior notification to customers of their 
intention to access the CRA’s-databaseconsumer credit data held 
by CRA(s) for the purpose of a review-(whetherwithin_or_ouiside 
the—transitional period} unless the review is initiated by the 


customer, or relates to an obligation of an existing loan 
restructuring arrangement concerning debts owed by the customer. 


The Code also requires credit providers to give notification to 
borrowers at the time of application for credit of the choice to opt- 
out of the positive credit data reporting system in respect of closed 
account data. 


Clause 2 2A of theThe Code-alse recommends that credit providers 
should give a written reminder to the borrower within 30 days of the 
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6.4 


6.5 


6.6 


occurrence of a default by the borrower, that unless the amount in 
default is fully repaid or written off (otherwise than due to a 
bankruptcy order) before the expiry of 60 days from the date of the 
default, the individual shall be liable to have his account repayment 
data to be retained by the-CRA(s) until the expiry of 5 years from 
the date of final settlement of the amount in default or 5 years from 
the date of the individual’s discharge from bankruptcy as notified to 
the-CRA(s), whichever is earlier. 


Clause 2.3-eftheThe Code also recommends that credit providers 
should give a written reminder to the borrower as soon as 
practicable upon repayment in full of the credit facility, of his right to 
opt-out of the positive credit data reporting system. 


Als should ensure that sufficient prominence is given to such 
notifications. Also, Als should establish clear and comprehensive 
written procedures for making such notifications to their customers. 
These procedures should set out clearly when the notification 
should be made, the manner in which the notification is to be made 
and the type of information to be included in the notification. As 
required by the Code, Als should keep proper internal records of 
notifications of access for review for two years as evidence of 
compliance with the requirements of the Code. 


Als should take appropriate steps to ensure that ‘he-CRA-4s(s) are 
promptly notified of any “opt-out” requested by their former 
borrowers once the conditions for the opt-out are met by such 
borrowers. 


: M k eee itionaLperiod 


— 











Subject_to—certain—exceptions,_the-Code—provides—that—a—eredit 
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«——_reviewing_existing credit facilities, for the implementation of 
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8.—Engagement of CRA(s) 
87.1 AtsAny Al that useuses the service of aany CRA should enter into a 


formal contractual agreement with thethat CRA that requires the 
CRA to have effective control systems to ensure compliance with 
all relevant requirements of the PDPO and the Code. AtsOn and 
after the Effective Date, the agreement should have—effective 
preceduresalso specify that the CRA should comply with all the 
relevant requirements in the prescribed documents in Schedule 1 of 


this module. An Al should put in place appropriate arrangements to 
monitor regularly the performance of thethat CRA, particularly in 


respect of its ability to comply with the requirements of the PDPO 
and, the Code, and on and after the Effective Date, as specified in 
the prescribed documents in Schedule 1 of this module. 
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87.2 AnAtThe agreement should censider whethere empower the Al to 
terminate its-relationship-with the_service of a CRA if it is aware of 
unacceptable practices of the CRA, or serious breaches of the 
requirements of the PDPO—or, the Code., or on and after the 
Effective Date, as specified in the prescribed documents in 
Schedule 1 of this module. The centractwith the CRAagreement 
should also specify that account data (including the mortgage 
account general data) provided by the Al shall remain the property 
of the Al and that the Al has the right to remevets—data-ernthe 
termination oHts-contract with the CRArequest the CRA to return or 
transfer the provided data to the Al or such person or entity 
designated by the Al on the termination of the agreement. The 
agreement should also cover the CRA’s _post-termination 
obligations as recommended by the HKAB and the DTCA. 


97.3 In the event that an Al uses the service of more than one CRAs, the 


Al should apply the requirements in sections 7.1 and 7.2 above for 
each of the CRAs involved. 

















I9 


Hong Kong Approach to Consumer Debt Difficulties 


98.1 When the information obtained from the CRA(s) reveals that a 
customer has incurred a level of indebtedness that may be 
unmanageable and the customer might have genuine difficulty in 
repaying the loans, Als should follow the guidelines set out in the 
“Hong Kong Approach to Consumer Debt Difficulties” to deal with 
such borrowers. 


| 98.2 Als should consider such cases sympathetically and discuss with 
the customer concerned to work out a solution that is mutually 
beneficial for both the customer and the Al concerned. In doing so, 
the customer should be made aware of the possibility of solving the 
problem by aan Interbank- Debt Relief Plan. 


98.3 Where the Al does not have a prior credit relationship with the 
individual who has applied for credit, the Al should suggest that the 
individual discuss the problem with the financial institution with 
which the individual has the major credit relationship as soon as 
possible. 
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Consultation 








98.4 Als should not hastily demand immediate repayment of loans or 
reduce credit lines or actively recommend transfer of the balance. 
Instead, Als should follow the framework and procedures which are 
laid down in the Agreement on Debt Relief Plans, and the 
framework and procedures for Individual Voluntary Arrangements, 
and work out a mutually acceptable solution with the customer as 


far as possible. 
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Schedule 1 


Prescribed documents issued by the Hong Kong Association of Banks, the DTC 
Association and the Hong Kong S.A.R. Licensed Money Lenders Association: 


1. Code of Practice for Multiple Credit Reference Agencies Model; 


2. Multiple Credit Reference Agencies Model Governance Framework; 
and 


3. Report for the Technical Model of the Multiple Credit Reference 
Agencies Model. 
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